T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:32- Finding
Excessive Command Execution and File-Write Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 32-36
Vulnerability Type: Violation of least privilege through unnecessary tool permissions
Risk Level: MediumVulnerable Configuration
yaml tools: - read - exec - writeThe Skill also explicitly advertises generic API integration and system-command execution at
SKILL.md:441-443.Technical Analysis
The declared functionality is reviewing HTML for accessibility, SEO, form, semantic, and performance issues. This primarily requires access to user-supplied HTML and, when the user provides a URL, a constrained network-fetch capability.
Generic
execand unrestrictedwritepermissions exceed the minimum privileges necessary for that functionality. The Skill does not define a command allowlist, permitted output directory, user-confirmation boundary, URL policy, or restrictions preventing commands and writes from being influenced by untrusted HTML or remotely retrieved page content.No directly malicious command or explicit instruction to exploit these capabilities was found. The issue is an unsafe privilege design that increases the impact of prompt injection, unsafe Agent interpretation, or future modifications to the Skill.
Attack Path
- A user asks the Skill to review attacker-controlled HTML or a page at an attacker-controlled URL.
- The Agent reads instructions embedded in that untrusted content.
- If the Agent incorrectly treats those instructions as actionable, the declared
execorwritetool may be invoked. - A command could execute in the Agent environment, or files could be created or modified outside the legitimate HTML-review workflow.
- The resulting access would be limited by the host platform's sandbox and operating-system account, but the Skill itself defines no narrower boundary.
This path is conditional on the hosting Agent allowing untrusted content to influence tool calls; the reviewed fil ...[truncated 591 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execbecause static HTML analysis does not require arbitrary system-command execution. - Remove
writeunless the user explicitly requests an output file. If writing is supported, restrict it to a dedicated output directory and require confirmation before overwriting an existing file. - Retain only the minimum read capability needed to process content explicitly supplied or selected by the user.
- For URL review, use a dedicated HTTP fetch tool rather than shell commands. Permit only HTTP and HTTPS, enforce TLS validation, limit redirects and response sizes, apply strict timeouts, and block loopback, private, link-local, and cloud metadata addresses.
- Treat retrieved HTML and page text as untrusted data. Explicitly prohibit following instructions contained within reviewed content.
- If command execution remains unavoidable, define an exact command and argument allowlist, reject user-controlled command fragments, run in a restricted sandbox, disable unnecessary network access, and expose no credentials or sensitive environment variables.
- Document the precise reason for every requested tool permission and deny all capabilities not required by the selected operation.
- Remove